ScyllaDB Auditing Tools

Introduction

In today’s data-driven world, ScyllaDB audit tools have become essential for maintaining security and compliance in complex database environments. ScyllaDB, known for its high-performance capabilities and Cassandra-compatible architecture, provides robust auditing features that help organizations track and monitor database activities.

As businesses increasingly rely on distributed databases for managing sensitive information, implementing proper database security measures becomes crucial. The need for comprehensive data audit solutions has grown significantly, especially in enterprises dealing with sensitive customer information and compliance requirements.

Native ScyllaDB Audit Tools

ScyllaDB Enterprise Edition includes built-in auditing capabilities that enable administrators to monitor and log various database activities. The native audit functionality can be configured through the scylla.yaml file.

audit: "table"
audit_categories: "DCL,DDL,AUTH"
audit_tables: "mykespace.mytable"
audit_keyspaces: "mykespace"

Audit logs can be stored in a ScyllaDB table or sent to Syslog. When using table storage, the structure looks like this:

CREATE TABLE IF NOT EXISTS audit.audit_log (
    date timestamp,
    node inet,
    event_time timeuuid,
    category text,
    consistency text,
    table_name text,
    keyspace_name text,
    operation text,
    source inet,
    username text,
    error boolean,
    PRIMARY KEY ((date, node), event_time)
);

Example of Native Audit Logs

SELECT * FROM audit.audit_log;

 date                | node       | event_time                          | category | consistency | table_name | keyspace_name | operation | source     | username | error
---------------------+------------+-------------------------------------+----------+-------------+------------+---------------+-----------+------------+----------+-------
 2024-02-15 10:00:00 | 192.168.1.1| 123e4567-e89b-12d3-a456-426614174000 | DCL      | QUORUM      | mytable    | mykespace     | SELECT    | 192.168.1.2| admin    | false
 2024-02-15 10:05:00 | 192.168.1.1| 123e4567-e89b-12d3-a456-426614174001 | DDL      | QUORUM      | mytable    | mykespace     | CREATE    | 192.168.1.2| admin    | false
 2024-02-15 10:10:00 | 192.168.1.1| 123e4567-e89b-12d3-a456-426614174002 | AUTH     | QUORUM      | mytable    | mykespace     | LOGIN     | 192.168.1.3| user1    | false
 2024-02-15 10:15:00 | 192.168.1.1| 123e4567-e89b-12d3-a456-426614174003 | DCL      | QUORUM      | mytable    | mykespace     | UPDATE    | 192.168.1.4| user2    | true

This example shows audit records for SELECT, CREATE, LOGIN, and UPDATE operations with details such as category, source IP, user, and error status.

ScyllaDB’s native auditing features support granular control across categories like DCL, DDL, AUTH, and ADMIN, enabling focused monitoring of security-critical events.

DataSunrise: A Set of Comprehensive Audit Tools

DataSunrise extends ScyllaDB’s audit features by providing a full-featured database activity monitoring platform tailored for ScyllaDB environments.

The platform offers real-time monitoring of all database activity with advanced features like privileged user tracking, query inspection, and automated compliance enforcement.

DataSunrise’s ScyllaDB Data Activity History maintains detailed logs of all database interactions, providing insight into operational trends and enabling effective incident response.

With intuitive interfaces and robust backend logging, DataSunrise empowers teams to maintain oversight, detect suspicious activity, and generate compliance reports with ease.

Conclusion

ScyllaDB audit tools are essential for securing modern distributed databases. While the built-in audit features provide a solid baseline, DataSunrise delivers an enterprise-ready solution for organizations needing deeper analytics, automation, and real-time security response.

To explore how DataSunrise can enhance your ScyllaDB security strategy, schedule a demo or download the trial version today.